CVE-2021-21234

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.

• CWE-22

• https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6Patch, Third Party Advisory
• https://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772Patch, Third Party Advisory
• https://github.com/lukashinsch/spring-boot-actuator-logview/security/advisories/GHSA-p4q6-qxjx-8jgpThird Party Advisory
• https://search.maven.org/artifact/eu.hinsch/spring-boot-actuator-logviewThird Party Advisory
• https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6Patch, Third Party Advisory
• https://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772Patch, Third Party Advisory
• https://github.com/lukashinsch/spring-boot-actuator-logview/security/advisories/GHSA-p4q6-qxjx-8jgpThird Party Advisory
• https://search.maven.org/artifact/eu.hinsch/spring-boot-actuator-logviewThird Party Advisory

Published

Jan 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21229Incorrect security UI in downloads in Google Chrome on Andro…6.5
• CVE-2021-2123Vulnerability in the Oracle VM VirtualBox product of Oracle …3.2
• CVE-2021-21230Type confusion in V8 in Google Chrome prior to 90.0.4430.93 …8.8
• CVE-2021-21231Insufficient data validation in V8 in Google Chrome prior to…8.8
• CVE-2021-21232Use after free in Dev Tools in Google Chrome prior to 90.0.4…8.8
• CVE-2021-21233Heap buffer overflow in ANGLE in Google Chrome on Windows pr…8.8
• CVE-2021-21235kamadak-exif is an exif parsing library written in pure Rust…6.5
• CVE-2021-21236CairoSVG is a Python (pypi) package. CairoSVG is an SVG conv…5.5
• CVE-2021-21237Git LFS is a command line extension for managing large files…7.8
• CVE-2021-21238PySAML2 is a pure python implementation of SAML Version 2 St…6.5
• CVE-2021-21239PySAML2 is a pure python implementation of SAML Version 2 St…6.5
• CVE-2021-2124Vulnerability in the Oracle VM VirtualBox product of Oracle …6